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Declaration of 
Clint Modesitt 
February 13, 2019 


UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF 
FLORIDA 
CASE NO.: 9:18-cv80176-BB/BR 


IRA KLEIMAN, 
as the personal representative of the Estate of David Kleiman, 
and W&K Info Defense Research, LLC 


V. 


CRAIG WRIGHT 


Case 9:18-cv-80176-BB Document 92-4 Entered on FLSD Docket 02/14/2019 Page 2 of 9 


1. I am a Director at AlixPartners, LLP (AlixPartners), a global business consulting 
firm. 

2: The facts set forth in this Declaration are based on personal knowledge and the 
documents provided to me. 

3: This Declaration is submitted in the matter of IRA KLEIMAN, as the personal 
representative of the Estate of David Kleiman, and W&K Info Defense Research, LLC v. 
CRAIG WRIGHT CASE NO.: 9:18-cv80176-BB/BR, to explain critical issues regarding the 
preservation of data stored on electronic devices. 

4. My education and experience fully qualify me to make the statements contained 
in this Declaration on those issues. I began my digital forensics career in 2001 with the 
Maricopa County Sheriff’s Office in Phoenix, Arizona and since that time have been 
providing federal, state, local and tribal courts and governments along with companies 
around the world with digital forensics and related investigative services. I earned a 
bachelor’s degree in Public Safety Administration from Grand Canyon University in 
Phoenix, Arizona. I hold several digital forensic and technology certifications including 
Guidance Software’s EnCase® Certified Examiner (EnCE), Seized Computer Evidence 
Recovery Specialist (SCERS) from the Federal Law Enforcement Training Center, Certified 
Fraud Examiner certification from the Association of Certified Fraud Examiners, and 
Certified Hacking Investigator from Wetstone Technologies. I am also a Licensed Private 
Investigator in the State of Texas, where I am based. A copy of my curriculum vitae is 
provided at the end of this declaration as Attachment 01. 

3. I understand that plaintiff Ira Kleiman has formatted and added additional data to 


electronic devices that are or might prove to be critical evidence in this case. 
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6. Under the circumstances, a review of any recoverable deleted data would need to 
begin with acquiring a forensic image of the digital storage media be it a computer hard 
drive, USB flash drive, or external hard drive. A forensic image is an exact bit-by-bit copy 
of the data stored on the original media, including all files, folders, unallocated space, and 
unused disk space. The copy is created in a manner that does not alter the original media and 
provides for later verification by generating an MDS hash signature or other repeatable 
signature at the time of creation to ensure that the data has not been altered and can be 
authenticated as evidence if needed. 

Te In most commonly used electronic storage media filing systems, deletion or even 
reformatting and reuse does not necessarily preclude possible recovery of data previously 
stored on the device. Collecting a full forensic image of the device would allow for the 
preservation, search, and recovery of any such data in a nonintrusive, efficient, and cost- 
effective manner. 

8. In most common computer operating systems, like versions of Microsoft 
Windows, and electronic media file systems, like NTFS, reformatting a drive makes the 
existing file system structures no longer readable by the operation system. The file system 
defines where files are stored on the disk. File system structures themselves are sometimes 
recoverable after reformatting through forensic imaging and interrogation of the imaged data. 

cP The continued use of a device after the reformatting of a drive or deletion of a file 
or files can limit the recovery of data previously deleted, as the use of the drive can overwrite 
the blocks and sectors storing the deleted data with new data. For these reasons, a forensic 


examination of the drive image will typically not only seek to uncover deleted files, but also 
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to identify use history regarding when the files were deleted and any subsequent use leading 
to further data loss. 

10. By searching across a forensic image copy of the media, rather than the original 
media itself, multiple devices can be searched at once, using faster, more robust, and 
redundant hardware. More importantly, by searching forensic image copies of the media, 
rather than the original media itself, the parties avoid the potential for further data loss or 
corruption, or failure of the original storage device while it runs, under heavy use, for hours 
or days until the searches are complete. 

11. It is for the above reasons that an immediate forensic inspection of the electronic 
devices at issue is necessary. 

Pursuant to 28 U.S.C § 1746(2), I declare under penalty of perjury that my 


statement here is true and correct. 


Dated: February 13, 2019 


4) fa) J. Jo 
ike Lt G7 at Corel Uv Zi f 


Clint Modesitt 
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Attachment 01 
Clint Modesitt CV 


IRA KLEIMAN, Declaration of Clint Modesitt, 
as the personal representative of the Estate of David Kleiman, AlixPartners 
and W&K Info Defense Research, LLC February 13, 2019 
v. 

CRAIG WRIGHT 


CASE NO.: 9:18-cv80176-BB/BR 
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Alix 
when it really 
matters 


POSITION 


EDUCATION 


PROFESSIONAL 
HISTORY 


PROFESSIONAL 
EXPERIENCE 


RANGE OF 
EXPERIENCE 


CURRICULUM VITAE 
OF 
CLINT A. MODESITT 


Director, AlixPartners, LLP, Houston, Texas 


B.S. Public Safety Administration, Grand Canyon University 


Mr. Modesitt has more than seventeen years of experience in 
information technology and as a forensic investigator, manager and 
trainer. Beginning in 2001, he has continuously provided computer 
forensic consulting and expert witness services in various litigation 
matters. Mr. Modesitt has a wide range of experience with 
information technology infrastructure, forensic acquisition and 
forensic analysis, including computer tampering, contract disputes, 
employment matters, network intrusions, intellectual property theft, 
and fraud. 


Mr. Modesitt has extensive experience providing design and 
installation of information technology infrastructures and network 
administration. He has provided technical expertise in criminal and 
civil investigations. As the Manager of Operations for a global 
forensics firm, Mr. Modesitt developed policies and procedures, case 
management, quality control and resource allocation. 


Mr. Modesitt has performed a variety of services related to computer 

forensics and investigations. A sample of these includes: 
e Computer forensics investigations 

Detection of intellectual property theft 

Analysis of a computer user's actions over specific time periods 

Recovery of deleted files 

Defensible forensic collection of ESI 

Filtering and searching for responsive documents and the de- 

duplication of mass ESI 

e Client site assessment of ESI, assistance with identification of 
items potentially responsive to eDiscovery obligations 

e Extensive experience as testifying experts at Federal, State and 
local levels 

e Remote forensic imaging and analysis 


1221 McKinney | Suite 3275 | Houston 77010 | 713.276.4900 | 713.276.4901 fax | www.alixpartners.com 
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PROFESSIONAL 
AFFILIATIONS 


ACCREDITATIONS 
AND LICENSES 


ADDITIONAL 
TRAINING AND 
EDUCATION 


CLINT A. MODESITT 
PAGE 2 


International Association of Computer Investigative Specialists (ACIS) 
Association of Certified Fraud Examiners (ACFE) 


EnCase® Certified Examiner (EnCE), Guidance Software 

Seized Computer Evidence Recovery Specialist (SCERS), Federal Law 
Enforcement Training Center 

Certified Hacking Investigator, Wetstone Technologies 

Certified Fraud Examiner, Association of Certified Fraud Examiners 
Licensed Private Investigator, Computer Forensics, State of Texas 


Axiom Examination, Magnet Forensics 
Advanced Incident Response and Digital Forensics, The SANS Institute 
Association of Certified Fraud Examiners CFE Exam Prep 


Computer Forensics Investigations — Windows In-Depth, The SANS 
Institute 


ASCLD/LAB-International Preparation Course for Testing Labs, 
ASCLD-LAB 


File Systems Revealed, X-Ways 

X-Ways Forensics, X-Ways 

EnCase NTFS, Guidance Software 

Hacking Boot camp, Wetstone Technologies 

Security+ (Comp TIA) / CISSP, Interface Technical Training 

EnCase Advanced Internet & Email Examinations, Guidance Software 
Intermediate Computer Forensics, Access Data 

EnCase Internet & Email Examinations, Guidance Software 


Seized Computer Evidence Recovery Specialist, Federal Law 
Enforcement Training Center 


Basic Data Recovery, International Association of Computer 
Investigative Specialists 


Intrusion Techniques and Countermeasures, Computer Security Institute 
Basic Data Recovery and Analysis, National White Collar Crime Center 
EnCase Intermediate Computer Forensics, Guidance Software 
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EXPERT 
WITNESS 
TESTIMONY 


CLINT A. MODESITT 
PAGE 3 


United States v. Kaleil Isaza Tuzman, et al., 
Case Number: 15 Cr. 536(PGG) 


Court: U.S. District Court, Southern District of New York 
Type: Testimony at Hearing 
Date: 12/06/2017 


Document Technologies, Inc., et al. v. West, et al. 
Case Number: 1:17-CV-02405 


Court: US. District Court, Southern District of New York 
Type: Testimony at Trial 
Date: 05/31/2017 


Alan K. Smith v. Cognate BioServices, Inc. et al. 
Case Number: 03-c-12-2363 


Court: Circuit Court for Baltimore County, Maryland 
Type: Deposition 
Date: 02/25/2014 


James H. Rock v. Alex W. Rangos and Glen T. Meakem 
Case Number: 08-27634 


Court: Court of Common Pleas of Allegheny County, PA 
Type: Deposition 
Date: 04/28/11 


Bridal Expo, Inc. v. Van Florenstein, Sonja 
Case Number: 200868106 


Court: Harris County District Court, 55th District (Texas) 
Type: Testimony at Evidentiary Hearing 
Date: 12/22/08 


Best Western International, Inc. v. John Doe 
Case Number: CV06-1537-PHX-DGC 


Court: United States District Court for the District of Arizona 
Type: Deposition 
Date: 02/15/08 


United Printing and Mailing Services, LLC v. Angela K. Turner 
Case Number: CV 2005-015531 


Court: Maricopa County Superior Court (Arizona) 
Type: Testimony at Trial 
Date: 07/27/07 
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Re: The Marriage of Kay L. Smith (Petitioner) and Mark Batemen 
Smith (Respondent) 

Case Number: FC 2002-094853 

Court: Maricopa County Superior Court (Arizona) 

Type: Testimony at Trial 

Date: 01/30/07 


Tourelle Development, Inc. v. Kathryn Proffitt 
Case Number: CV 2004-091530 


Court: Maricopa County Superior Court (Arizona) 
Type: Deposition 
Date: 11/28/06 


National Processing Management Group, Inc, et al. v. Frank Salman, 


et al. 

Case Number: CV 2005-05 1003 

Court: Maricopa County Superior Court (Arizona) 
Type: Testimony at Evidentiary Hearing 

Date: 11/14/05 


Jean Lee Ann (Tucker) Tabor v. Greg L. Sexton 
Case Number: 49C01-9307-JP-1791 


Court: Marion Circuit Court Paternity Court (Indiana) 
Type: Testimony at Trial 
Date: 04/28/05 


Ace Asphalt of Arizona, Inc. v. John T. McCormack 
Case Number: CV 2003-011843 


Court: Maricopa County Superior Court (Arizona) 
Type: Deposition 
Date: 10/9/03 


State of Arizona v. Craig Charles Rose 
Case Number: CR 2002-012446 


Court: Maricopa County Superior Court (Arizona) 
Type: Testified at Evidentiary Hearing 
Date: 1/17/03 
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